Commit Graph

64409 Commits

Author SHA1 Message Date
Pascal Quantin 2095b32599 call_heur_dissector_direct: do not trigger an assert if heuristic dissector rejects packet
This can happen for example is the heuristics changed between the Wireshark
version used to export PDUs, and the one used to open the file.
Instead, call data dissector.

Change-Id: I29f7754f883fd710c3557a610583ef988ca13e43
Reviewed-on: https://code.wireshark.org/review/17280
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-24 07:26:40 +00:00
Alexis La Goutte 20908f55f6 SCSI: Mode Sense 10: Wrong block descriptor length
Issue reported by Sharon Samuel Enoch

Bug:12780
Change-Id: I94ad5355cdfa4d8cd3915c9e261931ff56dc765b
Reviewed-on: https://code.wireshark.org/review/17272
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-24 07:23:53 +00:00
Pascal Quantin 5213496250 IPMI: do not use col_set_str with non const strings
Bug: 12782
Change-Id: Ia082ccf5355d7f8dd6073861c59c804fecc96266
Reviewed-on: https://code.wireshark.org/review/17289
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-24 06:12:41 +00:00
Pascal Quantin 8915bb2a4e ISAKMP: remove useless callback
isakmp_cleanup_protocol() and isakmp_init_protocol() are already registered
as cleanup and init routines

Change-Id: I4fd2348dc507c8bc933aebd5abfb2522b57da0b4
Reviewed-on: https://code.wireshark.org/review/17284
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-24 05:54:32 +00:00
Mirko Parthey 0fcca6f0c8 ISAKMP: fix DOI field read size
Read 4 bytes from the packet instead of 1 because that is the
correct size of the DOI field.
Reference: RFC 2408

Change-Id: I5745363811bb46af307a925d688ec36cfb29984b
Reviewed-on: https://code.wireshark.org/review/17271
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-24 04:38:26 +00:00
João Valverde 640382c743 CMake: Allow setting per target compiler warnings
Setting our compiler warning flags in CMAKE_C_FLAGS does not allow
using different flags per target.

Allow for that possibility by setting the internal WS_WARNINGS_{C,CXX}_FLAGS
and using the COMPILE_OPTIONS property to set them.

This change is just setting mechanism and there should be no difference
in generated warnings.

The check_X_compiler_flag cmake test is changed to test each flag individually.
We need a list, not a space separated string, and the aggregate test is not
significant.

Change-Id: I59fc5cd7e130c7a5e001c598e3df3e13f83a6a25
Reviewed-on: https://code.wireshark.org/review/17150
Petri-Dish: João Valverde <j@v6e.pt>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: João Valverde <j@v6e.pt>
2016-08-23 21:33:09 +00:00
Michał Skalski 505bcefd20 isakmp Fix IKEv2 modification UAT crash
Problem is that not all fields of UAT are updated on change (only those
defined in UAT definition with ikev2_uat_flds, specifically pointers to
encr_spec and auth_spec in ike2_decr_data_t were set to NULL.

Fixed by re-setting pointers after update table callback was called.

Also fixed memory leaks after UAT modification.

Bug was partially resolved with change
Ibdab979b5959eb561635cbcb446e17138baca87b
https://code.wireshark.org/review/17078

which eliminated crash, but decryption still didn't work after UAT
modification (DISSECTOR BUG was displayed).

Bug: 12748
Change-Id: I8209edd8e214d62e34b641fdd2e046b9ff4c95eb
Reviewed-on: https://code.wireshark.org/review/17249
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
Petri-Dish: Jaap Keuter <jaap.keuter@xs4all.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-23 21:31:37 +00:00
Chris Bontje e11d4a8913 [lg8979] - Fix dissection of 'Analog Group Change Report' Responses (FC2)
They follow the same dissection as normal 'Analog Change Report' Responses (FC0)

Change-Id: I854084f43fd0cc52ba02b6f1e760a63033ab48dd
Reviewed-on: https://code.wireshark.org/review/17270
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2016-08-23 20:38:52 +00:00
Guy Harris f4ad204745 Remove now-redundant check.
We now check much earlier for an invalid message length; remove the
check done afterwards.

Also, note that dissect_netlink_error() should also check the message
length, to make sure it doesn't run past the end of the message, and
indicate why we are assuming an "integer" is 4 bytes (it's because the
RFC is vague here).

Change-Id: Ie0b5074acc852cdeaa008fee1125130a6c8771a1
Reviewed-on: https://code.wireshark.org/review/17279
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 18:51:25 +00:00
Guy Harris 3479406d6f Get rid of trailing tabs.
Change-Id: I0c26f02a63a12acc900637cd6a106d26e386a7a8
Reviewed-on: https://code.wireshark.org/review/17278
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 18:41:59 +00:00
Guy Harris 111358e51b Catch too-short netlink message lengths.
0 would cause an infinite loop. and any value < 16 is clearly wrong, so
if we see such a packet, just show the header's length field and stop
dissecting.

Bug: 12776
Change-Id: Iefc56b26b83ff5424968d065bdb9fa84a7a65481
Reviewed-on: https://code.wireshark.org/review/17277
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 18:40:30 +00:00
Pascal Quantin 12cae9dc80 MAC LTE: fix dissection of CE Mode A RAR message
The Msg3 PUSCH narrowband index parameter depends on the UL bandwidth

Change-Id: Ib57c85ffbd4c108e9c8f3d14fa53a48f0df1b0e6
Reviewed-on: https://code.wireshark.org/review/17274
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-23 18:36:41 +00:00
Balint Reczey 40ac3c8682 Documentation with unset license is under project's license (GPL-2+)
doc/idl2deb.pod is licensed explicitly under GPL-2+ it is just
not recognized by the check.

Change-Id: Iabc7ee6bd6fe9080d6cdd28a29bb4c5f97b0ece9
Reviewed-on: https://code.wireshark.org/review/17268
Reviewed-by: Balint Reczey <balint@balintreczey.hu>
Petri-Dish: Balint Reczey <balint@balintreczey.hu>
Reviewed-by: Dario Lombardo <lomato@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
2016-08-23 15:02:31 +00:00
Michał Skalski c7ca0e88df dissector ISAKMP IKEv2: fixed bug with libgcrypt-1.6.x and AEAD ciphers
IKEv2: 
Fixed bug with AEAD ciphers with 8- and 12-byte length ICVs and
libgcrypt 1.6.x - gcry_cipher_checktag() returned INVALID_LENGTH.
Fixed for merged changeset https://code.wireshark.org/review/17078


Added support for verification of encrypted data with HMAC_MD5_128
[RFC4595] and HMAC_SHA1_160 [RFC4595] integrity algorithms

Added IKEv2 decryption suite for few combinations of encryption and
integrity algorithms: 3DES-CBC/SHA1_160, AES-128-CCM-12, AES-128-CCM-12
(using CTR mode), AES-192-CTR/SHA2-512, AES-256-CBC/SHA2-256,
AES-256-CCM-16, AES-256-GCM-16, AES-256-GCM-8


Change-Id: Ic564b25f1fd41e913c605322b7b8aa030cf90ddf
Reviewed-on: https://code.wireshark.org/review/17213
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Reviewed-by: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
2016-08-23 10:07:38 +00:00
Jonathan Muñoz 8d7aba1060 IEEE 802.15.4:dissecting header & payload information elements used by 6tisch.
This patch shows the Information Elements (IE) defined by the
IEEE802.15.4. It dissects the information of those IE which are used
by the IETF WG 6tisch and announces the others. Here the list of the
fully dissected ones:

- For the header IEs:
    - Time Correction.
    - Header Termination 1.
    - Header Termination 2.

- For the payload IEs:
    - MLME:
        - Nested Shorts:
            - TSCH Synchronization IE.
            - TSCH Timeslot IE.
            - TSCH Slotframe and Link IE.
        - Nested Longs:
            - Channel Hopping IE.
    - Payload Termination IE.

For the rest of the IEs defined in the standart, this patch shows them
but does not analyze their inner fields.

References:
https://datatracker.ietf.org/doc/draft-ietf-6tisch-minimal/
IEEE Standard for Low-Rate Wireless Personal Area Networks (WPANs).

Change-Id: I45292315fa532f08be6a218eb5756284a22eeee4
Reviewed-on: https://code.wireshark.org/review/16671
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-23 04:18:09 +00:00
Peter Wu 52910f4e3f isakmp: fix type confusion
Caught by ASAN with WIRESHARK_DEBUG_WMEM_OVERRIDE=simple set.

Manually inspection of all type casts to decrypt_data_t and
ikev2_decrypt_data_t showed no other users that do not check
isakmp_version first.

Change-Id: If889afff85a20e31222d33cbea8db3a91a77f389
Reviewed-on: https://code.wireshark.org/review/17246
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michał Skalski <mskalski13@gmail.com>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-23 04:12:32 +00:00
Guy Harris bee0cd7762 See if *this* convinces the compiler that valuelen and value will be set.
Change-Id: I2a7715ac3255502f244a0d0a7e588b3a44c34f11
Reviewed-on: https://code.wireshark.org/review/17258
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 03:36:55 +00:00
Guy Harris 9edb7afa84 More fields, more pre-allocated memory for fields.
Change-Id: I8362e64354c4ca985dbabc190cfb75d2bd31a5ad
Reviewed-on: https://code.wireshark.org/review/17257
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 02:58:03 +00:00
Guy Harris ff00166a96 Fix handling of parameters with no value.
Return a value length of 0 if there's no parameter value.

(And don't return anything if the pointers through which we return them
are null.)

If no value is present, return NULL from ws_find_media_type_parameter().

Change-Id: I32b57623d7651bcf065af5b81f2390a600988b21
Reviewed-on: https://code.wireshark.org/review/17255
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 02:28:56 +00:00
Guy Harris 4458c48cf4 Add cast to squelch "building with a C++ compiler" warnings.
Change-Id: Ia95c40096018479aec99fafd93d7b95d31ba4723
Reviewed-on: https://code.wireshark.org/review/17253
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 01:26:04 +00:00
Guy Harris 0b3a96222b Handle quoted-pairs in quoted-strings correctly.
Backslash, in a quoted-string, escapes quotes (and any other characters,
although the only ones that *need* escaping are a double-quote and a
backslash).

This means that the value of a parameter isn't just the raw characters
from the parameters string; for a quoted string, it needs to be
un-escaped, and for a *non*-quoted string, it has to stop at the first
non-token character (you can put comments in).  So
ws_find_media_type_parameter() must return an allocated string with the
actual value.

Get rid of index_of_char(); it doesn't do anything that strchr() does.

Change-Id: I36328ea71c28fe6ac4918a8e73c281a25f6be844
Reviewed-on: https://code.wireshark.org/review/17251
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-23 00:53:46 +00:00
Gerald Combs 943a9ede85 Update docbook/README.txt
Update to reflect current reality. Still needs a lot of work.

Change-Id: Id6bb12f5e8ca42bbadc237f148bb388b54a321e2
Reviewed-on: https://code.wireshark.org/review/17247
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2016-08-22 23:57:14 +00:00
Mirko Parthey 9c80ff0617 IKEv2: Add D-H Transform IDs for Brainpool Curves
Add Diffie-Hellman Group Transform IDs for the ECC Brainpool Curves.

References: RFC 6932, RFC 6954

Change-Id: I1ca0da8e5e06abbd1c53a591d01c1f05aa60c35a
Reviewed-on: https://code.wireshark.org/review/17231
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 19:21:04 +00:00
Balint Reczey ee0f94aaae Make index_of_char() static again
Change-Id: I1c0d344c50ee5d78dd8247ccfe795ce0cd94aaa2
Reviewed-on: https://code.wireshark.org/review/17230
Reviewed-by: Balint Reczey <balint@balintreczey.hu>
2016-08-22 13:28:24 +00:00
Balint Reczey e129aec558 debian: Update symbols file with new symbols
Some symbols are marked as appearing in 2.2 intentionally,
because they are cherry-picked to master-2.2.

Change-Id: Ia7807b3bddab0a069812f56c1be2eca8bf7d1cd4
Reviewed-on: https://code.wireshark.org/review/17232
Reviewed-by: Balint Reczey <balint@balintreczey.hu>
Petri-Dish: Balint Reczey <balint@balintreczey.hu>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-22 13:01:41 +00:00
Balint Reczey c43b8b5ef9 Rename find_parameter() to ws_find_media_type_parameter()
The symbols exported from libs should use less generic. preferably
prefixed names to avoid name collisions with other shared library
symbols.

Change-Id: I8323b3e194a7ee4d61baec0c007342fab6cbde84
Reviewed-on: https://code.wireshark.org/review/17229
Petri-Dish: Michael Mann <mmann78@netscape.net>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-22 13:01:25 +00:00
Andreas Leibold 22e421f7d3 Fixed a bug which might have caused a division by 0.
Variable "channels_per_frame" could have caused a division by 0.
This is now changed, by stopping dissection in this case. A warning is
shown for this case.

Change-Id: I6d4dcb91b833a7d7f0759e28f56950b94ab1ed7e
Reviewed-on: https://code.wireshark.org/review/17228
Petri-Dish: Anders Broman <a.broman58@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-22 12:56:57 +00:00
Binh Trinh b9e70e9b4c RANAP: Add an heuristic to decode the HO-to-UTRAN Command embedded in the RRC Container within the TargetRNC-to-SourceRNC Transparent Container
Change-Id: Iea7c8d24f52cf8bd11e13a53853e11ec1ecdcd36
Reviewed-on: https://code.wireshark.org/review/17058
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-22 12:08:31 +00:00
Alexis La Goutte 3f4ef54776 ipp: fix typo indent
Change-Id: Ibc44ab1e009f2dc07258b702f0e08aced38a66e2
Reviewed-on: https://code.wireshark.org/review/17223
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 11:17:43 +00:00
AndersBroman e8ba606348 [Diameter] Add Command codes 8388718 - 8388722.
Bug: 12774
Change-Id: I413ba4a195ee1bd3d7de66399d1be714ef77d7e2
Reviewed-on: https://code.wireshark.org/review/17227
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 10:36:41 +00:00
Guy Harris e83bdc67cc wmem_array_index() returns a *pointer* to the array element.
The array is an array of guint8 *'s that point to strings;
wmem_array_index() doesn't return a pointer to the string, it returns a
pointer to a pointer to the string, and you have to dereference the
result of the wmem_array_index() call to get a pointer to the string.

Change-Id: I8c7b3320f0979b01383ad255419c21cdeb7df4c7
Reviewed-on: https://code.wireshark.org/review/17221
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-22 07:38:15 +00:00
Guy Harris c00ea6f26e Look up the XML dissector the right way.
Looking up "text/xml" in the "media_type" dissector is somewhat of a
long-way-around way of finding the XML dissector; just look for it by
name.

Change-Id: Ifafeabc563bf7bfa529bc44ba31bf6ae376a09c8
Reviewed-on: https://code.wireshark.org/review/17219
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-22 06:44:10 +00:00
Guy Harris e1f11c9734 Get rid of trailing blank line.
Change-Id: I409a843b48983355c242708f6c9972bd8f337bf6
Reviewed-on: https://code.wireshark.org/review/17218
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-22 06:37:27 +00:00
Guy Harris 5825f59ddc Pass an HTTP message type to all HTTP subdissectors.
This gets complicated, because those subdissectors might be called by
other dissectors as well.  We need a better way of passing that sort of
out-of-bound information.

Pull some routines used for processing Content-Type parameters into
common code; we can't guarantee that the media parameters passed in
would be writable (passing it as *the* data hid that; passing a
structure with that *and* the HTTP message type revealed it), so don't
convert it to lower-case in place.

Use that information, if available, to determine whether an IPP message
is a requet or a response.

Change-Id: I4bccc9f05cd0b14ad445be7ab37b3d884d841325
Reviewed-on: https://code.wireshark.org/review/17216
Reviewed-by: Guy Harris <guy@alum.mit.edu>
2016-08-22 06:34:06 +00:00
Alexis La Goutte efdcb25360 ISUP: Enhance display of unknown (opt) parameter
Ping-Bug:12674
Change-Id: If67920246a9122dc693a71a4afcea212fb7f84ab
Reviewed-on: https://code.wireshark.org/review/17108
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 06:12:50 +00:00
Gerald Combs f062341540 Merge the CaveBear list into manuf.tmpl.
If the following lines at the top of "Ethernet.txt" are anything to go
by

----
$Revision: 2.83 $
$Date: 1999/03/09 11:36:19 $
$Author: map $
$Id: Ethernet.txt,v 2.83 1999/03/09 11:36:19 map Exp $
----

we've been fetching the same list over and over for quite some time.  Go
ahead and merge the CaveBear list with manuf.tmpl and stop fetching it
remotely.

Fixup the way we split the lines we get from the IEEE while we're here,
otherwise we log carriage returns in the middle of lines.

The following CaveBear lines were skipped during the merge:

Change-Id: I2110a7480a01a1bc5cbb6adf858acd9b5f75204c
00:00:10 - Skipping CaveBear "Hughes LAN Systems (formerly Sytek)" in favor of "Hughes"
00:00:11 - Skipping CaveBear "Tektronix" in favor of "Tektrnix"
00:00:1A - Skipping CaveBear "AMD (?)" in favor of "AMD"
00:00:20 - Skipping CaveBear "DIAB (Data Intdustrier AB)" in favor of "DIAB"
00:00:21 - Skipping CaveBear "SC&C (PAM Soft&Hardware also reported)" in favor of "SC&C"
00:00:24 - Skipping CaveBear "Olicom" in favor of "Olicom"
00:00:3D - Skipping CaveBear "AT&T" in favor of "AT&T"
00:00:46 - Skipping CaveBear "ISC-Bunker Ramo, An Olivetti Company" in favor of "ISC-BR"
00:00:4B - Skipping CaveBear "APT	-ICL also reported" in favor of "APT"
00:00:55 - Skipping CaveBear "AT&T" in favor of "AT&T"
00:00:5A - Skipping CaveBear "Xerox 806 (unregistered)" in favor of "SkSchnei               # SK	(Schneider & Koch in Europe and Syskonnect outside of Europe)"
00:00:62 - Skipping CaveBear "Honeywell" in favor of "Hneywell	# Honeywell"
00:00:63 - Skipping CaveBear "Hewlett-Packard		LanProbe" in favor of "HP"
00:00:69 - Skipping CaveBear "Concord Communications, Inc (although someone said Silicon Graphics)" in favor of "SGI"
00:00:6B - Skipping CaveBear "MIPS" in favor of "MIPS"
00:00:7A - Skipping CaveBear "Ardent" in favor of "Ardent"
00:00:7D - Skipping CaveBear "Cray Research Superservers,Inc		[Also Harris (3M) (old)]" in favor of "Cray"
00:00:A3 - Skipping CaveBear "Network Application Technology (NAT)" in favor of "NAT"
00:00:A5 - Skipping CaveBear "Compatible Systems Corporation" in favor of "CSC"
00:00:A7 - Skipping CaveBear "Network Computing Devices (NCD)	X-terminals" in favor of "NCD"
00:00:A9 - Skipping CaveBear "Network Systems" in favor of "NetSys		# Network Systems"
00:00:DD - Skipping CaveBear "Gould" in favor of "Gould"
00:00:DE - Skipping CaveBear "Unigraph" in favor of "Unigraph"
00:00:E1 - Skipping CaveBear "Hitachi (laptop built-in)" in favor of "Hitachi"
00:00:F6 - Skipping CaveBear "A.M.C. (Applied Microsystems Corp.)" in favor of "Madge"
00:01:FA - Skipping CaveBear "Compaq (PageMarq printers)" in favor of "Compaq"
00:02:04 - Skipping CaveBear "Novell NE3200" in favor of "Novell"
00:07:01 - Skipping CaveBear "Racal-Datacom" in favor of "Cisco		# RACAL-DATACOM"
00:20:85 - Skipping CaveBear "3COM SuperStack II UPS management module" in favor of "3Com"
00:40:0B - Skipping CaveBear "Crescendo (now owned by Cisco)" in favor of "Cresc"
00:40:96 - Skipping CaveBear "Telesystems SLW Inc" in favor of "Aironet		# Cisco Systems, Inc."
00:60:B0 - Skipping CaveBear "Hewlett-Packard" in favor of "HP"
00:80:0F - Skipping CaveBear "SMC (Standard Microsystem Corp.)" in favor of "SMC"
00:80:1C - Skipping CaveBear "Cisco" in favor of "Cisco		# NEWPORT SYSTEMS SOLUTIONS"
00:80:96 - Skipping CaveBear "HDS (Human Designed Systems)	X terminals" in favor of "HDS"
00:80:AD - Skipping CaveBear "CNet Technology			Used by Telebit (among others)" in favor of "Telebit"
00:90:B1 - Skipping CaveBear "Cisco" in favor of "Cisco"
00:E0:98 - Skipping CaveBear "Linksys				PCMCIA card" in favor of "Trend"
02:07:01 - Skipping CaveBear "Racal-Datacom" in favor of "Interlan               # Interlan [now Racal-InterLAN]	DEC (UNIBUS or QBUS), Apollo, Cisco"
02:CF:1F - Skipping CaveBear "CMC				Masscomp; Silicon Graphics; Prime EXL" in favor of "CMC"
08:00:02 - Skipping CaveBear "3Com (formerly Bridge)" in favor of "3Com"
08:00:03 - Skipping CaveBear "ACC (Advanced Computer Communications)" in favor of "ACC"
08:00:08 - Skipping CaveBear "BBN (Bolt Beranek and Newman, Inc.)" in favor of "BBN"
08:00:09 - Skipping CaveBear "Hewlett-Packard" in favor of "HP"
08:00:1A - Skipping CaveBear "Tiara? (used to have Data General)" in favor of "DataGenl	# Data General"
08:00:38 - Skipping CaveBear "Bull" in favor of "Bull"
08:00:3E - Skipping CaveBear "Motorola			VME bus processor modules" in favor of "Motorola"
08:00:69 - Skipping CaveBear "Silicon Graphics" in favor of "SGI"
08:00:79 - Skipping CaveBear "Silicon Graphics" in favor of "SGI"
08:00:90 - Skipping CaveBear "Retix, Inc.			Bridges" in favor of "Retix"
09:00:6A - Skipping CaveBear "AT&T" in favor of "AT&T"
10:00:90 - Skipping CaveBear "Hewlett-Packard			Advisor products" in favor of "HP"
10:00:D4 - Skipping CaveBear "DEC" in favor of "DEC"
3C:00:00 - Skipping CaveBear "3Com				dual function (V.34 modem + Ethernet) card" in favor of "3Com"
44:45:53 - Skipping CaveBear "Microsoft			(Windows95 internal "adapters")" in favor of "Microsoft"
Reviewed-on: https://code.wireshark.org/review/17212
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 04:46:52 +00:00
Michael Mann 6a7d5df1ae Add "Modbus/TCP over UDP"
There already is "ModbusRTU over UDP", this is the Modbus/TCP format over UDP.

Bug: 12768
Change-Id: I883aa8e88f8a1640459115434be84354e22bb361
Reviewed-on: https://code.wireshark.org/review/17215
Reviewed-by: Michael Mann <mmann78@netscape.net>
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 04:45:08 +00:00
Tom 3aac4b1549 Loosen HTTP token sting requirements so HTTP 1.0 can be included.
Bug: 12770
Change-Id: I5f71072231a752ce6cdedf6f22ce8931a61c39c7
Reviewed-on: https://code.wireshark.org/review/17214
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-22 04:43:40 +00:00
Peter Wu 928e907906 nflog: add fields for interface indices
Allows me to see the interface indices in a column.

Change-Id: I0dd31d7ec06eb860e7c80a4273779ec9034ee42d
Reviewed-on: https://code.wireshark.org/review/17193
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 23:49:23 +00:00
Alexis La Goutte 767e1a26b8 RANAP: fix indent (use 2 spaces) and modelines
Change-Id: I84e3157a9303572dcd3d9ff5df6802c42553e62f
Reviewed-on: https://code.wireshark.org/review/17197
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 23:48:49 +00:00
Alexis La Goutte cfa11ed37d mongo: add support for new mongodb 3.2 wire protocol opcodes
Add OP_COMMAND (2010) and OP_COMMANDREPLY (2011)

Bug:12723
Change-Id: Ib66e7136c7a6589286bbea11db2cff76d689db35
Reviewed-on: https://code.wireshark.org/review/17166
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 21:31:57 +00:00
Peter Wu 565dbf44ff nflog: support NFLOG bridge (ebtables) dissection
See net/netfilter/nfnetlink_log.c, that is the only place that sets
NFULA_PACKET_HDR to struct nfulnl_msg_packet_hdr.

Tested with nflog-ebtables.pcapng from SampleCaptures wiki.

Change-Id: I7e21f8f584f3911b3aa7d0d027ff9624886bef73
Reviewed-on: https://code.wireshark.org/review/17191
Petri-Dish: Peter Wu <peter@lekensteyn.nl>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 21:28:19 +00:00
Uli Heilmeier dc42aadcac CDP: Don't read outside payload for Port ID
Check if tvb remaining length is greater than expected length.

Bug: 12767
Change-Id: Ia04b559432af417db519cfcfbec06e6010b496bf
Reviewed-on: https://code.wireshark.org/review/17208
Petri-Dish: Jim Young <jim.young.ws@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
2016-08-21 17:44:49 +00:00
Alexis La Goutte 3509b072a6 LLC/STP (Cisco): Add Cisco Root Link Query PDU (STP)
Cisco RLQ BPDUs, request (PID 0x0108) and response (PID 0x0109) used to support Cisco's extension (Backbone Fast [1]) to original 802.1D spanning-tree protocol. The format of the BPDUs is same as original STP configuration BPDUs
[1] http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/12014-18.html
[2] http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/12014-18.html#anc9

Issue reported by Garri

Bug:12772
Change-Id: I0ffd169bf252ae11817c7a44ca3a67dfd4e221eb
Reviewed-on: https://code.wireshark.org/review/17204
Petri-Dish: Michael Mann <mmann78@netscape.net>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 16:26:06 +00:00
Gerald Combs a792a3b904 [Automatic update for 2016-08-21]
Update manuf, services enterprise-numbers, translations, and other items.

Change-Id: I92e3eefcb4670994fcab0d089c184ba5da2ab788
Reviewed-on: https://code.wireshark.org/review/17205
Reviewed-by: Gerald Combs <gerald@wireshark.org>
2016-08-21 15:07:34 +00:00
Alexis La Goutte 7804be057e ieee1722: fix Division by Zero found by Clang Analyzer and Coverity (CID 1371610)
Change-Id: Iac0ef122062f8dc3160e112d76c35a256f8d8c2a
Reviewed-on: https://code.wireshark.org/review/17201
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 14:57:43 +00:00
Alexis La Goutte 07611921be nstrace: fix Control flow issues (UNREACHABLE) found by Coverity (CID 1371612)
Change-Id: I76b3956d5b346412af5ff3aa5e0f6263dcb525a4
Reviewed-on: https://code.wireshark.org/review/17202
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 14:55:34 +00:00
Peter Wu c0ab12b23e netlink-netfilter,nflog: use NFPROTO_xxx instead of AF_xxx
These constants are mostly overlapping, except for NFPROTO_ARP. A manual
study of the Linux v4.7 code shows which fields to use and also reveal
that nflog.family can never be NFPROTO_ARP because (1) bridge traffic
use NFPROTO_BRIDGE and (2) arptables has no ULOG/NFLOG target.

This patch affects how some family fields are displayed but do not
affect subdissector calls.

Change-Id: I7cc73a8dcf73fe68c7ccaaa0f3b329fe484c8bfe
Reviewed-on: https://code.wireshark.org/review/17190
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 14:53:34 +00:00
Guillaume Autran 9902117f1a TCPROS - Protocol dissector improvements
- Added specific dissector for ROS Clock messages
 - Added dissector heuristics
 - Improve ROS traffic detection

Problems to resolve:
 - Some topics are mistaken for Clock messages. These includes the wheel encoder topic.
 - ROS Services are not detected.
 - Ideally, the TF topic should be dissected as it is a very common topic

Bug: 12749
Change-Id: I14255cbb42ae36b7e39f64dc1a5c6efffe19c8b1
Reviewed-on: https://code.wireshark.org/review/17086/
Reviewed-on: https://code.wireshark.org/review/17086
Reviewed-by: Alexis La Goutte <alexis.lagoutte@gmail.com>
Petri-Dish: Alexis La Goutte <alexis.lagoutte@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Michael Mann <mmann78@netscape.net>
2016-08-21 14:49:30 +00:00
Pascal Quantin 0a9e842649 COAP: ensure that key_token is always initialized
Even when the token length is 0.

Bug: 12771
Change-Id: I0d77f0411fe90a6702d1f23ba9cd4b61433a5995
Reviewed-on: https://code.wireshark.org/review/17194
Reviewed-by: Pascal Quantin <pascal.quantin@gmail.com>
Petri-Dish: Pascal Quantin <pascal.quantin@gmail.com>
Tested-by: Petri Dish Buildbot <buildbot-no-reply@wireshark.org>
Reviewed-by: Anders Broman <a.broman58@gmail.com>
2016-08-20 22:24:14 +00:00